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We analyze theoretically performance of four-state quantum key distribution protocols implemented with a 
realistic heralded single-photon source. The analysis assumes a noisy model for the detector heralding genera- 
tion of individual photons via spontaneous parametric down-conversion, including dark counts and imperfect 
photon number resolution. We identify characteristics of the heralding detector that defines the attainable 
cryptographic key rate and the maximum secure distance. Approximate analytical formulas are applied to 
multiplexed detection and compared with results of numerical calculations. 
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1. Introduction 

The security of quantum key distribution (QKD) is guaranteed by the fundamental impossibility 
to discriminate unambiguously non-orthogonal quantum states of an individual physical system 
P, 0] . Single photons are an obvious choice for such a system owing to easy preparation and 
detection of non-orthogonal states, combined with stable and robust long-haul transmission in 
optical fibers as well as in free space 0] . This makes single photon sources an essential component 
of many practical QKD setups [3]. 

Realistic single photon sources suffer from two imperfections. The first one is occasional gen- 
eration of two or more photons within a given temporal bin. This opens up a possibility of 
a successful eavesdropping attack based on photon number splitting, when an eavesdropper is 
able to capture and measure the state of one of the transmitted photons without revealing her 
presence. The second imperfection is the production of empty vacuum bins, when no photon 
is actually present. This lowers the key generation rate and, more importantly, increases the 
relative contribution of dark counts produced by detectors used in the receiver setup. If the 
security analysis conservatively attributes errors introduced by dark counts to the action of an 
eavesdropper, this ultimately limits the maximum distance of secure communication. 

The simplest realisation of a single photon state is a weak coherent pulse (WCP) derived from 
a heavily attenuated pulsed laser beam. The Poissonian statistics for the number of photons 
carried by such a pulse leads to a trade-off between the importance of multiphoton events and 
vacuum events. This defines the optimal pulse intensity to be used in a QKD protocol [5|. 
A more advanced approach is to use a heralded single-photon source based on the process of 
spontaneous parametric down-conversion (SPDC), in which pump photons spontaneously decay 
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into photon pairs [6(. Ideally, detecting one, idler photon from a pair unambiguously heralds 
the availability of the second, signal photon that can be subsequently used for a cryptographic 
protocol. This removes the vacuum component from the generated state 0]. Further, using a 
photon number resolving detector for heralding would eliminate the multiphoton component in 
the down-converted light beam. Consequently, the down-conversion process could be operated 
at higher pump powers, increasing the effective generation rate for single photons. 

The main purpose of this paper is to analyze theoretically the performance of realistic heralded 
single photon sources based on SPDC and photon number resolving detectors in the standard 
BB84 protocol. In practice, the attractive features of heralded sources can be compromised by a 
number of imperfections. Typical down-conversion sources do not guarantee perfect photon num- 
ber correlations between signal and idler photons: usually, there is a trade-off between collection 
efficiencies for the signal and the idler arms, especially when bulk nonlinear media are employed 
0-0] • Further, non-unit detection efficiency of the heralding detector undermines its photon 
number resolving capability, while dark counts in the heralding arm result in vacuum events in 
the signal arm. Starting from a general model for a realistic photon number resolving detector, 
we will identify its characteristics that is relevant for QKD applications. This generalizes earlier 
results obtained for a heralded source with a binary on/off detector [5(. The introduced formal- 
ism allows us also to discuss selected security aspects of other qubit-based four-state protocols, 
such as SARG04 [10] which offers partial protection against multiphoton events. 



In our analysis, we leave aside decoy-based protocols [llMla]. in which the benefits of heralded 
sources are less clear. A fair way to compare key rates would be to match the repetition rate of 
weak coherent pulses used to encode quantum states in the standard scheme with the repetition 
rate of pulses pumping the down-conversion medium in the heralded scheme. For decoy-based 
protocols, optimization over the pump power would then yield unrealistically high requirements 
for the efficiency of the down-conversion process 14| and pulses generated by such a source 
would contain a substantial multiphoton component. A way out would be to arrange an array a 
weakly pumped down-conversion sources [HI] followed by a multiport switch picking up a photon 
from a source flagged by the respective heralding detector. However, the complexity of such a 
setup would lead in practice to additional losses that might easily compromise its performance. 
Furthermore, the modal structure of SPDC radiation needs to be carefully taken into account in 
decoy-based protocols [lf|. This makes us focus on non-decoy protocols for which the security 
analysis is much better understood, especially in the regime of finite key lengths 171 ]. 

This paper is organized as follows. In Sec. [2] we introduce basic expressions that characterize 
the performance of the QKD protocol with a heralded single-photon source. The short-distance 
limit, when dark counts can be neglected, is discussed analytically in Sec. [3] In Sec. H]we give 
approximate expressions for the maximum secure distance. These results are compared in Sec. [5] 
with numerical results and the advantages of multiplexed heralding are discussed. Finally, Sec. [6] 
concludes the paper. 



2. Key rate 

We will consider here the standard physical layer of the BB84 protocol: Alice prepares one of 
four qubit states that form two mutually unbiased bases, while Bob switches between projective 
measurements in one of these two bases and directs two orthogonal states to separate detectors. 
We assume that errors are the same in both bases, which is a reasonable model for phase and 
polarization encodings. The starting point of our discussion will be an expression for the key 
rate K as a function of the quantum bit error rate (QBER) Q determined by Alice and Bob 
from the statistics of events, and the fraction y of detection events generated by pulses that 
genuinely contained a single photon. We assume that Eve performs a photon number splitting 
attack, capturing one photon and letting the second one travel without any disturbance. We 



November 21, 2012 



2:19 



Journal of Modern Optics 



Quantum'key distribution' with'realistic'heralded'single'photon'sourccs 



Journal of Modern Optics 



will approximate her information gain for multiphoton pulses by its value for two-photon cases 

(2) 

I\ E , taken as independent of Q. We also assume that the observed QBER stems entirely from 
an attack on single-photon pulses, and that Eve prevents any detection events to occur at Bob's 
side when Alice sends a vacuum pulse. These assumptions lead to the following expression for 
the secure key rate 

k = Pc . pPs m[iAB(Q) - yi^liQ/v) - (i - vVaeI 0) 

where p exp is the total expected probability of a detection event, p sr f t is the fraction of all the 
events contributing to the raw key, and I^ E (Q/y) is Eve's information gain for single-photon 
pulses, calculated for the QBER rescaled by y to account for the multiphoton fraction that 
is assumed to introduce no errors. The quality of the raw key is characterized by the mutual 
information Iab{Q) between Alice and Bob, equal to 

Iab(Q) = 1 - H(Q), (2) 

where H{x) = —x log 2 x— (1— x) log 2 (l— x) is the binary entropy. For the standard BB84 protocol 
we have p s ift = 1/2, as bases chosen by Alice and Bob are compatible in 50% of the cases. Eve's 
collective attack on single-photon pulses yields mutual information equal to I A l E {Q) = H(Q) 
0], while the photon number splitting attack makes two-photon pulses completely insecure and 

consequently I^ E = 1- 

The formula assumed in Eq. ([T|) can be applied also to certain eavesdropping strategies for 
other protocols. As an example we will consider here the SARG04 protocol. In this case we will 
take p s ift ~ 1/4, neglecting a minor change in this value for a non-zero QBER. Eve's collective 
attack on single-photon pulses results in her information gain described by an expression [l|| 

IaUQ) = (1 - Q) lo g 2 (l - Q) - (1 - 2Q) log 2 (l - 2Q) + Q(l - log 2 Q). (3) 

Further, if Eve applies the photon number splitting attack to two-photon pulses and attempts to 
infer the key bits only from retained photons, her task is more difficult than in the BB84 protocol 
since the information revealed publicly by the legitimate parties does not identify unambiguously 
the measurement basis. In fact, having learned the public information Eve is left with the problem 
of discriminating between two equiprobable non-orthogonal states with the absolute value of their 
scalar product e qua l to l/y/2. Consequently, her maximal information gain is bounded by the 
Holevo quantity [19( calculated for this ensemble, which yields the value 

J S = H({2 + \/2)/4) « 0.6009. (4) 

In the following, key rates calculated using the two sets of formulas for the BB84 and SARG04 
protocols will be denoted respectively as i^BB84 and -Ksargo4- It should be noted that the eaves- 
dropping model considered here makes sense as long as Eve's information gain from multiphoton 
pulses exceeds that from single photon events, i.e. I^ E (Q/y) < i fL- If this condition does not 
hold, the photon number splitting attack is not effective and it should be replaced by a more 
general multiphoton attack. For the BB84 protocol, the condition I^ E (Q/y) < I^fh is satisfied 
automatically, as multiphoton events are completely insecure. In the case of the eavesdropping 
strategy for the SARG04 protocol described above one needs to restrict applicability to suffi- 
ciently low ratios Q/y. This issue will be highlighted in Sec. HI The consistency of the obtained 
results with the assumptions made in the security analysis should be checked numerically when 
applying results derived in this paper to a specific experimental scenario. 
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In the next step, we need to relate the parameters p ex p, Q, and y to the properties of the 
actual physical setup. We will consider a heralded single photon source based on a multi-mode 
SPDC process, in which the statistics of the number of generated pairs are well approximated 
by the Poissonian distribution [16( . Consequently, the probabilities p n of generating n = and 
n = 1 pairs can be written respectively as po = e~ x and pi = Ae~ A , where A <C 1 is defined by 
the pump power and the strength of the nonlinear interaction. The probability of producing two 
or more pairs is given by p2 = 1 — Po — Pi = 1 — (1 + A)e~ A . In the perturbative regime of weak 
pumping the dominant contribution to multiple events comes from generation of double photon 
pairs, and our security analysis will assume that all multiple events are of this form. 

One of the down-converted photons, used as a herald, is measured by a detector on Alice's 
side. Only events in which Alice's detector signalled the presence of exactly one photon are 
retained by Alice and Bob. Let us denote by qi, i = 0,1,2, the conditional probability that 
the heralding detector generated this outcome, provided that it received i photons. For an ideal 
photon number resolving detector we have q\ = 1 and qo = q<i = 0. Deviations from this perfect 
characteristics will have a critical impact on the performance of the source. The results for weak 
coherent pulses are recovered for the no-heralding case qo = q\ = qi = 1. 

Two other relevant parameters are the transmission of the optical channel from Alice to 
Bob multiplied by Bob's detection efficiency, denoted here by a single parameter T, and the 
probability of a dark count on each of Bob's two detectors ds <C 1. The expected overall 
probability of a detection event is given by an expression: 



where we ignored double-count events described by terms of the order of Tds, T 2 , and d\. As 
on average half of dark count events generate errors for both BB84 and SARG04 protocols, the 
QBER is given by 



This QBER level will be interpreted as a result of Eve's attack on single-photon pulses. Finally, 
the fraction of detection events that can be attributed to single photons is 



In the following sections we will discuss performance of QKD in the regime of short distances on 
one hand and derive an approximate expression for the maximum secure distance on the other 
hand. These results will be compared with complete numerical calculations based on general 
formulas introduced above. 

3. Short distance limit 

In order to gain intuition about differences between various realizations of the protocol, let us 
first consider the short-distance limit when the overall transmission of the optical channel is 
relatively high so that the number of detection events generated by actual photons substantially 
exceeds that triggered by dark counts. In this case, simple estimates on the key rates can be 
obtained by entirely neglecting dark counts on Bob's detectors. Under this assumption, the 
expression for the key rate simplifies to the form 



Pexp 



(5) 




(6) 



Pexp 



K = Pex P Psift[l - (1 - V)Iae\ = Psift[Tpiqi - P2Q2{I ( ae - 2T )] 



(8) 
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Figure 1. A schematic of a multiplexing detector splitting the input signal using balanced couplers, each with overall 
transmission n c , and directing outputs to individual binary detectors characterized by the efficiency r\A and the dark count 
rate cLa- 



(2) 

which can be used for both BB84 and SARG04 protocols by a suitable choice of p s ^ t and I AE - 
In order to optimize the performance of the protocol, we need to maximize the right hand side 
of the above formula with respect to the pump strength A. The maximum is reached at 



^short 



Tqi 



T qi + (lf E -2T)q 2 



0) 



In the regime when Tq\ <C (I AE — 2T)q2 we can approximate A sri0r t ~ Tqi/[I AE ~ ^T]q2 and 
take pi A sri ort, P2 ~ -^short/2- This yields the following compact formula for the key rate: 



r(2) 



K 



PsiitT 2 



12 2 {I% 



2T) 



(10) 



It will be convenient to use the superscript for quantities specialized to the case of weak 
coherent pulses, while the superscript ( H > will denote quantities calculated for a general heralded 
single photon source. It is seen that properties of the detector enter through the factor qf/q2- 
Because for weak coherent pulses q\j(h = 1) we immediately obtain that 



K [H) 



q2 



(ii) 



The above formula provides a simple criterion to characterize the usefulness of the heralded 
source for short distance. Let us note here that in order to ensure consistency of the above 
estimates with the perturbative treatment of the photon number distribution, we should ensure 
that A s hort 1. This means that the channel transmission is low enough and the detector is 
sufficiently imperfect to carry out calculations in the perturbative regime, but at the same time 
the rate of detection events is high enough to neglect the dark counts on Bob's detectors. 

As an exemplary application of Eq. (Illh . let us consider an A^-stage tree beam splitting scheme 
shown in Fig. HJ which formally is equivalent to time- multiplexed detection [20j, |2l(. At each 
stage, the input light is split into twice as many beams using balanced couplers. The output 
ports are monitored with binary detectors characterized by the efficiency t]a and the dark count 
probability cLa- A straightforward calculation based on classical probability theory yields the 
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following expressions for conditional probabilities qt: 





= (1 


~d A f N 


-'2 N d A , 




?1 


= (1 


-d A r 


- l [2 N d A (l 


-Va) + Va], 


92 


= (1 


-d A r- 


- l [2 N d A (l 


- Va) 2 + 2 VA (1 - VA ) + 2- N V 2 A 



(12) 



These formulas assume lossless 50/50 couplers used in the multiplexing detector. In order to 
consider realistic lossy couplers with overall power transmission r] c each, we will replace in the 
above expressions r\ A by rj A r]^ . 

For high count rates, in the first approximation we can neglect dark counts also on Alice's 
detector. Then the ratio q\jq 2 is given explicitly by a compact formula 



q 2 2/(rrf)-2 + 2-^ 



(13) 



It is seen that if r/ c = 100%, increasing the number of stages improves the ratio q\jq 2 and the 
standard expression for a photon number resolving detector is recovered in the limit N — > oo. 
This however relies critically on the assumption of perfectly lossless couplers, as otherwise the 
effective efficiency r\ A r^ tends to zero. 

The heralded source yields higher key rate than weak coherent pulses when q\jq 2 > 1, which 
can be written as the following condition on Alice's detector efficiency: 

VAVc > 3 _\-N - ( 14 ) 

For a binary heralding detector, which corresponds to N = 0, the heralded source cannot bring 
any advantage over weak coherent pulses in the short distance regime. In the limit of full pho- 
ton number resolution, when N — > oo, the efficiency of the heralding detector should exceed 
rj A r]^ > 2/3 to offer an improvement over weak coherent pulses. As rj A includes also the collec- 
tion efficiency of heralding photons, this poses rather stringent requirement on the usefulness of 
heralded single photon sources in the short distance regime. 

In the following sections we will see that heralded sources warrant security over significantly 
longer distances compared to weak coherent pulses, and that the short-distance approximation 
presented above works for heralded sources well beyond the maximum secure distance of the 
WCP scheme. In this case, we need to compare factors q\jq 2 calculated for binary and mul- 
tiplexed heralding. The expression derived in Eq. (]13p suggests that for favourable technical 
parameters multiplexing can boost the secret key rate. 



4. Maximum distance 

We will now consider the other limiting case and estimate the maximum distance — or equiv- 
alently the minimum transmission of the optical channel — over which a secure key can be es- 
tablished. For low transmission, a larger fraction of events is generated by dark counts, which 
increases the value of QBER. We will focus our attention on the regime when the sender cannot 
afford to produce too many multiphoton events which would provide Eve with more informa- 
tion than single photons without contributing to the QBER. In this regime we can linearize the 
condition for the positivity of the key to the form 

Q<Q th [l-£(l-2/)], (15) 
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b) SARG04 




Figure 2. Contour plots of the renormalized key rate for (a) BB84 and (b) SARG04 protocols. In (b), the parameter region 

not satisfying the assumption I^hiQ/y) < 1s blanked out and separated with a dashed line. The thick solid lines (red 
online) depict the linearized necessary condition for the key security given in Eq. (1 1 5 D - 



where Q th is the threshold QBER for an ideal single photon source obtained from the equa- 
tion lAB(Q th ) = ^A£;(Q th )) an d £ is the proportionality factor that characterizes the effective 
reduction in this value introduced by the fraction of multiphoton events. These two parame- 
ters depend on the protocol under consideration and their numerical values are Q th ~ 0.11 and 
£ « 1.25 for the BB84 protocol and Q th ps 0.0968 and £ ~ 0.64 for the SARG04 protocol. In 
Fig. [21 this linearized condition is superimposed on the contour plots of the renormalized key 
rate K/p exp calculated for BB84 and SARG04 protocols. Note that for the SARG04 protocol, 

the applicability is restricted by the condition I^ E (Q/y) < I^ E . 

Before analyzing the performance of the heralded source, it will be helpful to revisit, using 
Eq. (115j) as the starting point, the bounds on minimum transmission for a perfect single-photon 
source and weak coherent pulses obtained by Brassard et al. [5]. In the case of an ideal single 
photon source, we have Q = d B / '(T + 2d B ). Using this expression we can transform Eq. (fl~5|) to 
the form T > tQ L where the minimum transmission for a perfect single-photon source (y = 1), 
denoted below as tQ ' , is given by 



T (i) 

min 



d B 



1 - 2Q th 



(16) 



For weak coherent pulses, we need to transform Eq. (|15p into a lower bound on T and then mini- 
mize it over the average photon number, which yields the optimal A^S? = [2de(l — 2Q th )/Q th £ t ] 1 / 2 
and the minimum transmission is equal to 



f2d B £(l-2Q 



thx\ 1/2 



Q 



th 



(17) 



1/2 

This expression scales as dg for the dark count probabilities d B <C 1 and therefore is much 

larger than T^ n , which depends linearly on d B - 

An analogous procedure can be applied to a heralded single photon source. Neglecting terms 
of the order of P2Q2 m formulas Eqs. ([5|) and ([6]) and inserting them along with Eq. ([7|) into 
Eq. (|15p gives the following constraint on the transmission T: 



rp 1-2Q 
2q l Q 



th 



th 



+ d B 



1 - 2Q th g0 1 
Q th qiX' 



(18) 
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The minimum value of the right hand side is achieved for 



It is easy to see that the explicit expression for the minimum transmission which guarantees 
secure communication with heralded single photon sources can be formally represented as a 
combination of T^ n and 2^2 defined respectively in Eqs. (fT6|) and (TT 



1 ram- a B g th ' ^<*Bs g th ^ 2 ^ _ J min + ^ -'min- *, ZU J 



For perfect photon number resolving detection, when (/o?2 = 0> the minimum transmission 
reaches T^ n . It should be noted that if only one of the parameters qo and c/2 is zero, the 
expression (fT9j) becomes singular: either X op ^ — > implying that the expected event rate goes to 
zero, or AL, t — > oo, which means that generation of multiple pairs is not harmful if they can be 



perfectly sifted out. On the other hand, inserting </o = q\ = </2 = 1 into Eq. (j20|) recovers in the 

(c) 

leading order of ds the weak coherent pulse value 

For realistic parameter values we have 3> T^ n due to less favorable scaling with ds- 

Therefore the factor (qo^) 1 /qi appearing in Eq. fj20f) will define the usefulness of a heralded 
single photon source in QKD: the lower its value, the longer the achievable secure distance. 
As a quantitative illustration, in Fig. [3] we plot the factor (qoQ2) 1 ^ 2 /qi as a function of the 
detector efficiency t]a and the dark count probability d& for a binary heralding detector and 
multiplexed detection discussed in Sec.[3]with iV = 3 and 4 stages. We see in Fig.[3ja) that binary 
heralding indeed extends substantially the secure distance (equivalently, lowers the minimum 
secure transmission) compared to the WCP scheme, as pointed out first by Brassard et al. [5|]. For 
multiplexed heralding shown in Fig. [3^b,c), the factor (9092) /<Zi increases. This means that the 
maximum secure distance is shortened compared to binary heralding, but nevertheless remains 
much longer than in the WCP scheme. When g?a <C 77^477^/(1 — 774 77^), we can approximate 

(g0g2)V2 « df ( 1 + ^^f) V2 • (21) 

When comparing this result with binary detection (N = 0), we see that indeed the increased rate 
of dark count events resulting from multiplying the number of detectors overrides the benefits 
of photon number resolution, with the exception of an unrealistic case when 77477^ = 100%. 

Although multiplexing fails to enhance the maximum secure distance achievable with heralded 
sources, it can bring benefits in the intermediate regime when the WCP scheme is no longer 

(C) ( H) 

secure. Namely, if the transmission of the channel remains below T„. ; , but above the value Tj. 

J 1 min 7 min 

for multiplexed heralding, results of Sec. [3] suggest that multiplexing can be used as a relatively 
straightforward way to increase the key rate above that offered by binary heralding. Numerical 
results presented in the next section will confirm this observation. 



Numerical results 



In order to gain a more complete picture of the performance of analyzed QKD protocols, we 
will now present numerical optimization of the key rate given in Eq. ([T]) over A, which has the 
interpretation of the average photon number for the weak coherent pulse implementation and 
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icr 4 



Figure 3. Contour plots of the expression (<?o<?2) 1 / 2 /'?i as a function of cLa and r/A with rj c = 98% for (a) a binary detector 
and multiplexed detection with (b) N = 3 and (c) N = 4 stages. 



the pair production probability for a heralded single photon source. This optimization needs to 
be carried out individually for each overall transmission T of the optical channel. As a model 
for the photon number resolving detector we use the multiplexing scheme described in Sec. [3j 

The results for the BB84 protocol are shown in Fig. i As a reference, we plot key rates 
attainable with weak coherent pulses and a heralded source employing a binary on/off detector. 
As analyzed in Sec. O the critical parameter is the efficiency t)a of the heralding detector. For 
sufficiently high efficiencies, multiplexing is beneficial over a wide range of transmission, including 
the entire range when the weak coherent pulse implementation offers security. For lower tja, the 
optimal scheme over short distances (i.e. high transmission) is to use weak coherent pulses. 
However, the corresponding security range is rather limited. Beyond that limit, for intermediate 
distances, multiplexing provides an advantage until security becomes compromised by increased 
dark count rates. In the regime of very low transmissions, a heralded source with a binary 
detector is the only setup that still warrants security. 

The plots show that over a large part of the intermediate distance the approximation from 
Sec. [3] still holds. Therefore Eq. (|13p provides a simple method to estimate the increase in the 
key rate when a multiplexing detector is used in lieu of a binary one and to find the optimal 
number of multiplexing stages when couplers are lossy. In Fig. [5] we depict the ratio of the key 
rates for an iV-stage mutliplexed heralding and binary heralding as a function of t]a calculated 
using Eq. (|13p . assuming non-unit transmission of couplers equal to rj c = 98%. The optimum is 
achieved for either iV = 3 or iV = 4 stages, depending on the efficiency T)a- Fig. [5] also shows 
that this simple analytical derivation agrees quite well with enhancements determined from 
fitting numerical results in the short-distance regions where the key rate remains approximately 
proportional to T 2 . 

Fig. [6] shows analogous results for the SARG04 protocol assuming the specific eavesdropping 
strategy discussed in Sec. [2j We found that for weak coherent pulses and low transmissions 
numerical optimization of the pulse amplitude took us outside the regime when I^ E {Q/y) < 

(2) 

therefore we depict here only results for a heralded single photon source and compare 
performance of multiplexed and binary heralding. It is seen that again multiplexing is more 
beneficial for high heralding efficiencies but leads to a reduction of the maximum secure distance. 



6. Conclusions 



In this paper we analyzed the potential advantages of realistic heralded single photon sources in 
quantum key distribution based on four-state qubit protocols. We identified the characteristics 
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Figure 4. Log-log plots of key rates for the BB84 protocol as a function of the overall channel transmission T calculated 
numerically for (a) r\j± = 80%, (b) rjA = 60%, and (c) r\j^ = 40%. Numerical results are shown for weak coherent pulses 
(x, green online), a binary heralding detector (o, red online), and a multiplexed heralding detector (+, blue online) with 
the number of stages maximizing the key rate in the short distance regime (N = 4 for (a), N = 3 for (b) and (c)). Other 
parameter values are r\ c = 98%, d\ = 10 -6 , and ds = 10 -5 . Solid lines depict the analytical approximations of the key 
rates in the short distance regime obtained from Eq. l(TTJ. Vertical dashed lines depict minimum transmissions calculated 
using Eq. (1201 ) . Line colors online correspond to those of the numerical results. 
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Figure 5. The ratio of key rates for an ./V-stage mutliplexed heralding detector and a binary detector as a function of r\A 
calculated using Eq. (Tl3l for ij c = 98%, Aa = 10~ 6 , and N = 2 (orange, dotted line) N = 3 (blue, solid line), N = 4 (green, 
dashed line) and N = 5 (red, dot-dashed line) (colors online). Symbols X depict results obtained by fitting numerical data 
(using linear regression method) to the model K oc T 2 for the optimal numbers of splitting stages: N = 3 for r]A = 40% 
and r tA = 60%, and N = 4 for ija = 80%. 

of detectors used for heralding that is relevant to the performance of QKD protocols, including 
the key rates in the high-transmission limit when dark counts can be neglected, as well as the 
minimum transmission that still ensures key security. This can be used to evaluate the usefulness 
of new approaches to achieve photon number resolution [13], such as multipixel [13, 24] or 
superconducting [2^] detectors. 

The results were specialized to the case of multiplexing detectors, which offer partial photon 
number resolution while adding relatively little extra complexity to the experimental setup 
compared to binary on/off detection. We found that increasing the key rate above that attainable 
with weak coherent pulses poses stringent requirements on the overall efficiency in the heralding 
arm of the SPDC setup, including collection efficiency of down-converted photons. However, the 
implementation based on weak coherent pulses has a very restricted security range, and beyond 
this limit multiplexing can increase the key rate compared to binary heralding. Unfortunately, 
for very long distances (i.e. low transmissions), the increased dark count rate of the multiplexing 
scheme jeopardizes security leaving the single binary detector as the only option. 
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